H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used Invoke-PSImage to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)

33 recorded

Relationships

subtechnique-ofTechnique
uses
from ABK
Malware
usesGroup
uses
from APT37
Group
usesGroup
uses
from Avenger
Malware
uses
from Bandook
Malware
uses
from BBK
Malware
usesGroup
usesMalware
uses
from Diavol
Malware
usesGroup
uses
from IcedID
Malware
usesTool
usesGroup
usesMalware
usesGroup
usesMalware
uses
from Okrum
Malware
usesCampaign
usesCampaign
uses
from Pikabot
Malware
usesMalware
usesMalware
uses
from ProLock
Malware
usesMalware
uses
from Ramsay
Malware
uses
from RDAT
Malware
uses
from RegDuke
Malware
uses
from TA551
Group
uses
from TeamPCP
Group
usesGroup
3 external

References

mitre-attack
T1027.003
open
McAfee Malicious Doc Targets Pyeongchang Olympics
https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/
open
Wikipedia Duqu
https://en.wikipedia.org/wiki/Duqu
open